KR101709417B1 - Security mode for mobile communications devices - Google Patents

Abstract

There is provided a system and method for implementing a secure mode in a mobile communication device, the mobile communication device comprising: a processor; And a computer readable storage medium storing programming to be executed by the processor, the programming including activating a security mode of the mobile communication device; Includes instructions for disabling the features of the first class of the mobile communication device in accordance with the activation of the secure mode and other features of the mobile communication device remain enabled after activation of the mobile security.

Description

SECURITY MODE FOR MOBILE COMMUNICATIONS DEVICES < RTI ID = 0.0 >

<Cross reference of related application>

This application claims priority to U.S. Serial No. 13 / 528,345, filed June 20, 2012, entitled " Security Method for Mobile Communications Devices, " which is incorporated by reference in its entirety.

<Technical Field>

The present invention generally relates to a security mode for mobile devices.

Modern mobile devices may, in their nature, introduce potential security violations when introduced into security facilities. For example, mobile devices may allow a user to communicate information (e.g., confidential or otherwise) with a remotely located third party via a signal (e.g., cellular, text, email, etc.) And may allow on-board recordation / storage of information via one or more recordation / storage features, for example, video / image cameras, voice recorders, scanners, . To address these security concerns, the administrator and / or security officer may require visitors to leave their mobile devices at a security check point upon entry to the facility. However, this practice may be inconvenient for visitors, since the entrusted mobile device may include useful applications or features (e.g., calendars, contacts, slideshows, etc.) that a visitor may wish to access during a visit. As such, techniques or methods are required that reliably and securely disable the features of the first class of mobile devices (e.g., those that contain security threats) while not disabling other features.

Technical advantages are generally achieved by the preferred embodiments of the present invention including a secure mode for mobile devices.

According to an embodiment, there is provided a mobile communication device for activating a security mode for disabling features of a first class of a mobile communication device, wherein at least some features of the mobile communication device are enabled (enable).

According to another embodiment, there is provided an apparatus for securing a mobile communication device, the apparatus being configured to transmit a lock signal to activate a secure mode of the mobile communication device. In this example, activation of the secure mode prevents the mobile device from disabling at least some features of the mobile communication device while disabling the video and audio recording features of the mobile communication device.

According to yet another embodiment, a method of operating a mobile communication device comprises the steps of: detecting, by a mobile communication device, a lock command comprising a lock code; and, upon detecting a lock command, . In this example, activation of the secure mode disables the video and voice recording features of the mobile communication device, while disabling other features of the mobile communication device.

BRIEF DESCRIPTION OF THE DRAWINGS For a more complete understanding of the present invention and the advantages thereof, reference is now made to the following description taken in conjunction with the accompanying drawings,
Figure 1 shows a view of a security installation.
Figure 2 shows a block diagram of an embodiment of a mobile device.
3 shows a flow diagram of an embodiment of a method for implementing a secure mode of a mobile device.
Figure 4 shows a block diagram of another embodiment of a mobile device.
Corresponding numbers and symbols in different drawings generally refer to corresponding parts unless otherwise indicated. The drawings are shown to clearly illustrate the relevant aspects of the preferred embodiments, and are not necessarily drawn to scale.

The manufacture and use of presently preferred embodiments are discussed in detail below. It should be understood, however, that the present invention provides a number of applicable inventive concepts that may be implemented in a wide variety of specific contexts. The specific embodiments discussed are merely illustrative of specific ways in which the invention may be made and utilized, and are not intended to limit the scope of the invention.

1 illustrates an embodiment of a security appliance architecture 100. FIG. The security appliance architecture 100 includes a plurality of mobile devices 110, 120, and a secure zone 130. Mobile devices 110 and 120 may be capable of participating in wireless communications (e.g., cell phones, tablets, laptops, etc.) or otherwise storing data for regeneration and / (E.g., non-wireless devices having a recording function) may be a collection of any device or components. Security zone 130 may be any area where an administrator or security officer wishes to restrict certain features of the mobile device. For example, the secure zone 130 may be a government archive, or a private compound, housing sensitive or confidential information. The secure zone 130 includes a check point 134 and data 136. The checkpoint 134 may be a controlled access point that is monitored (e.g., by a security officer or otherwise) to provide limited access to the secure area 130. For example, the checkpoint 134 may include a secure terminal that monitors the access point (on its own or otherwise). The security terminal performs various security procedures. For example, the visitor may present identification at checkpoint 134 and verify that he or she is carrying the mobile device. The data 136 may include information that is not intended for public dissemination / distribution (e.g., transaction confidentiality, personal health records, financial documents, etc.), or information intended for controlled dissemination / distribution in a controlled manner , Copyrighted material, etc.). &Lt; / RTI &gt;

In an embodiment, the visitor carrying the mobile device 110 moves through the checkpoint 134 into the secure area 130. At checkpoint 134, the visitor verifies that he or she has mobile device 110 and allows the security officer to manually (or voluntarily) activate the secure mode of mobile device 110. The secure mode may include any component or feature (e.g., hardware, software, or combination thereof) of the mobile device 110 that allows features of one class to be disabled for a period of time without disabling all of the features of the device ). The secure mode may include tracking functionality (e. G., Global positioning system (GPS) software or other) that allows administrators to monitor the location of the mobile device 110 when the mobile device 110 moves throughout the secure area 130. & ). After a period of time, the visitor moves the checkpoint backwards, bringing the mobile device 110 out of the secure area 130. At that time, the security officer manually (or voluntarily) deactivates the secure mode of the mobile device 110, thereby re-enabling previously disabled features.

A feature can be classified based on whether it is considered to impose a security risk if it is left enabled. For example, features of the first class may include features that are considered to impose a security risk if left as enabled, while features of the second class may impose a security risk if left with an enable May include features that are not considered. According to an embodiment, the features of the first class include a voice recorder, a video recorder, a still picture camera, a voice call service, an Internet access, a texting, a recordable memory, Regeneration, and / or other features that may facilitate dispensing. On the other hand, the features of the second class are not related to the communication and / or recording of data by the calendar, the portable document format reader, the video player (i.e., having no recording features), the read only memory, Other features may be included.

In some embodiments, the classification of features may be performed by an administrator to achieve various levels of security and various levels of security of the mobile device functionality. For example, features of the first class may be more inclusive if the required security level is relatively high (e.g., in a Pentagon, or other area that becomes highly secure). If, on the other hand, the required security level is medium or low (and the level of required mobile device functionality is medium or high), as in a media event (e.g., a concert) It can be comprehensive. In some embodiments, the features of the first class may include features used to record video and / or audio, such as a camera and a voice recorder. In the same or other embodiments, the features of the first class may further include features capable of recording a large amount of text, such as a scanner or the like. In yet other embodiments, features of the first class may include any features used to record or communicate new data, wherein the new data is not pre-stored on the mobile communication device and / (E.g., by the administrator) to include any data not independently generated by the mobile communication device for tracking / monitoring of the communication device (e.g., And is excluded from the new data if it was created to allow tracking of the device). In some embodiments, the new data may be stored in a memory such that a small amount of data (e.g., data that does not exceed a certain number of bytes) can be stored by the visitor (e.g., a calendar event, (By the administrator) to exceed a certain number of bytes (e.g., a certain number of bytes of data). Obviously, limiting the definition of new data in such a manner will still prevent large-scale dissemination of security information (which may be the result of, for example, scanning / recording confidential information).

 The first class of communication features may (or may not) include features that allow a user to transmit / receive data over a cellular or non-cellular link. For example, an embodiment may include all cellular communications in features of a first class. Other embodiments may exclude data reception from features of the first class, thereby allowing a user to store data (e.g., text messages, etc.) received over a cellular link. Various other features may be specifically excluded (or included) from the class of communication features by the administrator. For example, it is acceptable for a user to create a calendar entry, but opening a recordable word processing application may be prohibited because the latter has a significantly higher security threat than the former.

In some embodiments, the features of the first class may specifically target a particular type of dissemination (e.g., mass storage / transmission, etc.). For example, in an entertainment venue (e.g., a concert, a movie theater, etc.), an administrator may prohibit the use of recording devices (such as video / audio recorders) capable of storing copyrighted material, (E.g., text, voice, etc.) may still be allowed. In such embodiments, the features of the first class may include only those features that allow the user to clone / record a particular type of media.

In some embodiments, the features of the first class allow the user to write data to removable and / or external memory devices (e.g., flash memory cards, secure digital high capacity (SDHC) cards, etc.) &Lt; / RTI &gt; In some embodiments, the secure mode includes hash algorithm features such as message digest five (MD5), secure hash algorithm-1 (SHA-1), or some other feature that prevents large amounts of stored data from being altered can do. For example, a user may attempt to compete with a system by entering a large amount of false contact information before entering the security facility and then replacing the information with security information. A hash feature (e.g., MD5 or SHA-1) may generate a signature of the stored data upon activation of the secure mode, for comparison during deactivation. Thus, if the comparison shows that there is a large discrepancy between stored data (respectively) upon activation and deactivation, the security officer may be warned. Alternatively or additionally, the secure mode may include a feature that stores all new or modified data in a special file that can be analyzed when coming out of the security facility.

FIG. 2 shows a block diagram of an embodiment of a mobile device 200. FIG. The mobile device 200 includes a collection of features 210 that may be implemented in software, hardware, or a combination thereof. Collections of features include features 220 of a first class and features 230 of a second class. As discussed above, the classification of the features is based on the required security level and / or the required mobile device functionality. In some embodiments, the first class of features 220 may include a video recorder 221, an audio recorder 222, a wireless transmitter 223, and a writable memory 225. In the same or other embodiments, features 230 of the second class may include a video player 231, an audio player 232, a wireless receiver 233, and a readable memory 235. When operating in the secure mode, the user of the mobile device 200 can access the set of enabled features 230, but not the disabled set of features 220. In an embodiment, a small portion of the writable memory is partitioned off and enabled so that when the mobile device 200 is operating in a secure mode, certain types of data (e.g., a radio receiver 223), calendar entries, etc.) can be stored and / or accessed by the user.

Figure 3 illustrates an embodiment of a method 300 for securing a visitor &apos; s mobile device within a secure facility. The method 300 begins at step 310 where the mobile device accesses the security facility. Next, the method 300 proceeds to step 320 where the mobile device checks in at a security checkpoint.

In some embodiments, the secure mode feature may be enabled / disabled (in addition to being enabled / disabled) for the purpose of preventing accidental or unintentional loss of communication capability. For example, if the secure mode feature remains enabled, it may be inadvertently (or maliciously) activated by a third party. This can be inconvenient for a user who may not have a way to disable the mobile security feature without the unlocking code (e.g., without sending it to the service). Therefore, during normal operation of the device, the user can leave the secure mode feature disabled, thereby preventing unintentional (or malicious) activation of the secure mode feature by a third party. Thus, the method 300 may (optionally) include step 330, wherein the user or security officer may enable the secure mode feature (or alternatively, that the security mode is enabled differently have). In other embodiments, enabling / disabling the feature may or may not be necessary and the secure mode may be enabled (i. E., Disabled) at the mobile device at any time. For example, if the activation of the secure mode requires client-authorization (positive acknowledgment or otherwise), then to prevent accidental or unauthorized activation of the secure mode (activation may require client acknowledgment) Disabling the security mode may be unnecessary. It may be the case that the activation of the secure mode involves using a client-authorized transport layer security (TLS) handshake procedure to provide an encrypted lock or unlock PIN code. The TLS handshake (or other similar procedures) can ensure that only security facilities can activate the secure mode.

Next, the method 300 proceeds to step 340, where the mobile device is prompted to activate the secure mode of the mobile device. Activation of the secure mode can be achieved in various ways. In some embodiments, the security officer manually sets the security mode using a "star code" and a randomly generated PIN code, e.g., * 37 * PIN-code #, entered via the mobile device's keypad or other operating mechanism . In other embodiments, the mobile device is prompted using the wirelessly transmitted lock command from the checkpoint terminal. In an embodiment, the lock command may be transmitted or initiated using the OTA (over the air) protocol. In other embodiments, the lock command procedures utilize Bluetooth or Wi-Fi protocols and include one or more encryption layers. For example, the communication between the checkpoint terminal and the mobile device uses a Bluetooth protocol including the Security Manager Protocol (SMP) to achieve AES (Advanced Encryption Standard) encryption, for example AES-128. Alternatively, the communication between the checkpoint terminal and the mobile device utilizes a Wi-Fi protocol including AES encryption using Hypertext Transfer Protocol Secure (HTTPS) and / or 64-character cryptographic keys.

After activating the security mode, the method proceeds to step 350 where the visitor enters the security facility with the security mode activated on the mobile device. An additional feature of the secure mode may be a tracking feature that allows the security officer to monitor the location of the mobile device when the mobile device moves throughout the security facility. The tracking feature includes establishing a Wi-Fi connection between the mobile device and a terminal operated by a security officer. In an embodiment, the tracking feature may periodically (e. G., Transmit) an encrypted signal that defines a GPS location or WiFi cell location of the mobile device, via a Wi-Fi connection that may be established using AES encryption and / Every 30 seconds).

At step 360, the visitor comes out of the security facility, at which time the visitor checks in on the security checkpoint at step 370. Obviously, there may be many security checkpoints in the security facility, and visitors may come through checkpoints that are different from the ones they have entered. Upon checking in to the security checkpoint (or immediately after checking in), the security officer deactivates the security mode in step 380, thereby re-enabling the disabled feature set. In some embodiments, the secure mode may be disabled in step 390, which may (optionally) be included as part of method 300.

In some embodiments, deactivating the secure mode includes inputting an unlock pin. The unlocking pin may include a random pin generated when the mobile device enters the facility. It may be stored in the encrypted file on the mobile device at activation but may otherwise be disabled by the user of the mobile device until it comes out of the security facility or secure area. In some embodiments, it may be necessary to store the unlock pin in the encrypted file on the mobile device so that subsequent verification of the unlock pin can be performed. In other embodiments it may be unnecessary. In some embodiments, the secure mode includes an alert feature for alerting security personnel to potential security threats (or attempted security threats). For example, the alert mode may be triggered by a certain number of unsuccessful unlock code attempts (e. G., Three unsuccessful attempts) and may be triggered by a message transmitted via Bluetooth or a Wi-Fi connection, For example, a siren circulating on and off) to warn the security officer. If the alarm feature is a siren, it can cyclically cycle on and off (e.g., turned on for five minutes and off for two minutes), through input of the correct pin code, or alternatively, For example, by inputting a master code, or the like.

FIG. 4 shows a block diagram of an embodiment of a mobile device 400. FIG. The mobile device 400 may include a processor 404, a memory 406, a cellular interface 410, a Bluetooth interface 412, an auxiliary interface 414, and a GPS interface 416, May be arranged as shown or may be arranged differently. The processor 404 may be any component capable of performing calculations and / or other processing related tasks, and the memory 406 may be any component capable of storing programming and / or instructions for the processor 404 have. The cellular interface 410 may be any collection of components or components that allow the mobile device 400 to communicate using cellular signals and may be used to receive and / or transmit information over the cellular network . The Bluetooth interface 412 may be any collection of components or components that allow the mobile device 400 to communicate using the Bluetooth protocol, for example, when activating the security mode, when providing proximity information Etc. &lt; / RTI &gt; The auxiliary interface 414 may be any collection of components or components that allow the mobile device 400 to communicate via an auxiliary protocol such as the Wi-Fi protocol. The auxiliary interface 414 may be utilized for various management and / or other functions. The GPS interface 416 may be used to receive GPS information.

While the invention and its advantages have been described in detail, it should be understood that various changes, substitutions and alterations can be made therein without departing from the spirit and scope of the invention as defined in the appended claims. Moreover, the scope of the present application is not intended to be limited to the specific embodiments of the process, machine, article of manufacture, composition of matter, means, methods and steps described herein. Those skilled in the art will readily appreciate from the disclosure of the present invention that the corresponding embodiments described herein may achieve substantially the same results as those that may be utilized in accordance with the present invention, Methods, or steps of processes, machines, products, materials, or materials to be developed or subsequently developed. Accordingly, the appended claims are intended to include within their scope such processes, machines, articles of manufacture, compositions of matter, means, methods or steps.

Claims (23)

A mobile communication device,
A processor; And
A computer-readable storage medium having stored thereon a program for execution by the processor,
Lt; / RTI &gt;
The above-
Instructions for activating a security mode of the mobile communication device; And
Instructions for disabling the first class of features of the mobile communication device upon activation of the secure mode;
/ RTI &gt;
Wherein the first class of features includes video and voice recording features, cellular transmission features, and features that facilitate storage or communication of new data by the mobile communication device, Is defined as any information that is not previously stored on the mobile communication device and is not independently generated by the communication device to enable tracking of the mobile communication device,
Wherein at least some features of the mobile communication device remain enabled after activation of the secure mode. delete delete 2. The mobile communication device of claim 1, wherein the instructions for activating the secure mode comprise instructions for activating a global positioning system (GPS) feature to monitor the location of the mobile communication device. 2. The mobile communication device of claim 1, wherein the instructions for activating the secure mode comprise instructions for establishing a non-cellular connection to wirelessly exchange encrypted communication with a secure terminal. 6. The mobile communication device of claim 5, wherein the non-cellular connection is a wireless fidelity (WiFi) or Bluetooth connection. 2. The mobile communication device of claim 1, wherein the programming further comprises: instructions for enabling the secure mode prior to activating the secure mode. 2. The method of claim 1,
Instructions for detecting an unlocking pin code; And
Instructions for determining whether the unlock pin code is correct based on information associated with the lock pin code received upon activation of the secure mode
&Lt; / RTI &gt; 9. The method of claim 8,
Instructions for deactivating the secure mode if the unlock pin code is determined to be correct, wherein deactivation of the secure mode re-enables features of the first class of the mobile communication device; And
Instructions for disabling the secure mode
&Lt; / RTI &gt; 9. The method of claim 8,
Instructions for activating a warning mode, each of the incorrect lock code entries constituting an attempt to deactivate the security mode if it is determined that incorrect unlock pin codes have been entered a predetermined number of times; And
Commands for performing a warning function to warn the security personnel of a potential security breach
&Lt; / RTI &gt; 11. The mobile communication device of claim 10, wherein the alert function is an audible alarm or noise emitted continuously or at periodic intervals until a correct unlock pin code is input. 11. The mobile communication device of claim 10, wherein the alert function is a wireless signal transmitted to a security checkpoint or control station to alert a security officer about the potential security violation attempted. An apparatus for securing a mobile communication device,
A processor; And
A computer readable storage medium storing programming for execution by the processor,
Lt; / RTI &gt;
The programming includes instructions for transmitting a wireless lock signal over a non-cellular channel to a mobile communication device,
Wherein the lock signal activates a security mode of the mobile communication device to disable features of a first class of the mobile communication device while not disabling at least some other features of the mobile communication device, Includes features facilitating the storage and communication of video and audio recording features of the mobile communication device, cellular transmission features, and new data by the mobile communication device, wherein the new data is transmitted prior to activation of the security mode Is not stored on the mobile communication device and is defined as any information that is not independently generated by the communication device to enable tracking of the mobile communication device. 14. The apparatus of claim 13, wherein the features of the first class include all features that are considered to contain a security threat if left to be enabled. delete 14. The method of claim 13, wherein the programming further comprises: instructions for monitoring a location of the mobile communication device when the mobile communication device moves through a security facility, wherein the monitoring comprises a secure wireless fidelity (Wi-Fi) Wherein said secure Wi-Fi connection is established upon receipt of global positioning system (GPS) information via said secure Wi-Fi connection. 14. The mobile communication device of claim 13, wherein the programming further comprises: instructions for sending an unlock signal to deactivate the secure mode of the mobile communication device, wherein deactivation of the secure mode comprises: Lt; RTI ID = 0.0 &gt; re-enable &lt; / RTI &gt; 14. The apparatus of claim 13, wherein the non-cellular channel is a wireless fidelity (WiFi) or a Bluetooth channel. A method of operating a mobile communication device,
Detecting, by the mobile communication device, a wireless lock command comprising a lock code, the wireless lock command being communicated over a non-cellular communication channel; And
Activating a security mode of the mobile communication device in response to detection of the wireless lock command, wherein activation of the secure mode comprises disabling features of a first class of the mobile communication device, Wherein the features of the first class include features that facilitate the storage or communication of video and voice recording features of the mobile communication device, cellular transmission features, and new data by the mobile communication device , The new data is not stored on the mobile communication device prior to activation of the secure mode and is defined as any information not independently generated by the communication device to enable tracing of the mobile communication device,
&Lt; / RTI &gt; 20. The method of claim 19,
Detecting an unlocking pin code;
Determining that the unlock pin code is valid; a valid unlock code is required to deactivate the secure mode; And
Re-enabling features of the first class by deactivating the secure mode
&Lt; / RTI &gt; 21. The method of claim 20,
Verifying that the secure mode is enabled prior to activating the secure mode; And
After disabling the secure mode, disabling the secure mode
&Lt; / RTI &gt; 20. The method of claim 19, wherein activating the secure mode comprises:
Randomly generating an encrypted pin code;
Establishing a secure communication connection with the mobile communication device through a transport layer / secure socket layer security (TLS / SSL) handshake procedure; And
Transmitting the encrypted pin code via the secure communication connection, wherein the encrypted pin code is stored on the mobile communication device and used to verify the unlocked pin code upon deactivation of the secure mode;
/ RTI &gt; 20. The method of claim 19, wherein the non-cellular communication channel is a wireless fidelity (WiFi) or a Bluetooth channel.

Images